1093 matches found
AZL-33492 CVE-2023-42366 affecting package busybox for versions less than 1.35.0-12
A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the nexttoken function at awk.c:1159...
Trellix Application and Change Control Path Traversal Vulnerability
Trellix Application and Change Control Trellix ACC is an application and change control program from FireEye USA Trellix. A path traversal vulnerability exists in Trellix Application and Change Control TACC versions prior to 8.4.0, which stems from a path traversal vulnerability in the TACC ePO...
m-privacy TightGate-Pro Server Security Vulnerability
The m-privacy TightGate-Pro Server is a remote control browser system from the German company m-privacy. A security vulnerability exists in m-privacy TightGate-Pro Server versions prior to 2.0.406g, which originates from an easily compromised access control on X11 server sockets, allowing an...
Devellion CubeCart Cross-Site Request Forgery Vulnerability
Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images in an online store, etc. A cross-site request forgery vulnerability exists in Devellion CubeCart versions prio...
PT-2023-30878
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.176 Description An issue was discovered in the app/Model/AppModel.php file, where it mishandles filters. Recommendations For versions prior to 2.4.176, update to version 2.4.176 or later to resolve the issue...
ManageEngine SupportCenter Plus < 14.2 Build 14200
The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 14.2 Build 14200. It is, therefore, affected by a vulnerability as referenced in the support-centerCVE-2023-38331 advisory. - Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS i...
CVE-2023-47609
SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter the information stored in the database by sending a specially crafted request...
PT-2023-30483 · Unknown · Photo Feed
Name of the Vulnerable Software and Affected Versions: Photo Feed plugin versions prior to 2.2.1 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website, potentially allowing them t...
Fortinet Fortigate DOS in headers management (FG-IR-23-151)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-151 advisory. - A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10,...
Kyverno security breach
Kyverno is a policy engine for Kubernetes open-sourced by Kyverno. A security vulnerability exists in versions prior to Kyverno v1.11.0. An attacker exploited the vulnerability to cause a denial of service on the system...
DOMPurify Security Vulnerability
DOMPurify is a DOM Document Object Model written in JavaScript for HTML, MathML and SVG. A security vulnerability exists in versions of DOMPurify prior to 1.0.11, which stems from a missing attribute for links...
AZL-31759 CVE-2023-38472 affecting package avahi for versions less than 0.8-3
A vulnerability was found in Avahi. A reachable assertion exists in the avahirdataparse function...
F5 Networks BIG-IP : Multi-blade VIPRION Configuration utility session cookie vulnerability (K29141800)
The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K29141800 advisory. - An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG- ...
CVE-2023-26583
Unauthenticated SQL injection in the GetCurrentPeriod method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers...
PT-2023-23093 · Unknown · Gotham Orbital-Simulator
Name of the Vulnerable Software and Affected Versions: Gotham Orbital-Simulator service versions prior to 0.692.0 Description: The issue allows an unauthenticated user to read arbitrary files on the file system due to a Path traversal problem. Recommendations: For versions prior to 0.692.0, updat...
CVE-2023-46298
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN...
reconFTW Operating System Command Injection Vulnerability
reconFTW is a tool from the individual developers at six2dez designed to perform automated reconnaissance of target domains by running a best-of-breed toolset to perform scans and find vulnerabilities. A security vulnerability exists in versions prior to reconFTW v2.7.1.1, which stems from...
PT-2023-28994 · Arduino · Arduino Create Agent
Name of the Vulnerable Software and Affected Versions: Arduino Create Agent versions prior to 1.3.3 Description: This issue affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhos...
PT-2023-23378 · WordPress · Wordpress Gallery Plugin
Name of the Vulnerable Software and Affected Versions: WordPress Gallery Plugin versions prior to 3.39 Description: The issue is related to PHAR Deserialization due to a lack of input parameter validation in the gallery edit function. This allows an attacker to access arbitrary resources on the...